CVE-2026-33661

The record

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.

Affected packages

Related vulnerabilities

• CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its… CWE-290
• CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-290
• CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions. CWE-290
• CVE-2026-82563 An attacker could impersonate the camera and place themselves in a man-in-the-middle or… CWE-290
• CVE-2026-82530 IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control… CWE-290
• CVE-2026-77089 Command Center API contained an authentication bypass issue affecting privilege… CWE-290
• CVE-2026-86478 In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in… CWE-290
• CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function… CWE-290